build-pyvex.yml

# SPDX-FileCopyrightText: 2026 The RISE Project
# SPDX-License-Identifier: MIT
---
# This workflow is based on: https://github.com/angr/ci-settings/blob/0b2428c46c155584d3029761adcd9b6138ab85d0/.github/workflows/angr-release.yml
name: Build pyvex wheels (riscv64)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version glob to (re)build; empty builds every version of docs/packages/pyvex.yaml not released yet'
        required: false
        default: ''
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/build-pyvex.yml'
      - 'docs/packages/pyvex.yaml'
  push:
    branches: [main]
    paths:
      - '.github/workflows/build-pyvex.yml'
      - 'docs/packages/pyvex.yaml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read  # to fetch code (actions/checkout)

env:
  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
  MUSLLINUX_RISCV64_IMAGE: quay.io/pypa/musllinux_1_2_riscv64

jobs:
  setup:
    uses: $/.github/workflows/_setup.yml
    with:
      package: pyvex
      version: ${{ inputs.version }}

  build_wheels:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
        libc: [manylinux, musllinux]
    name: Build pyvex ${{ matrix.version }} cp312-abi3-${{ matrix.libc }}_riscv64
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 60
    env:
      PYVEX_VERSION: ${{ matrix.version }}

    steps:
      - name: Checkout pyvex ${{ env.PYVEX_VERSION }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: angr/pyvex
          ref: v${{ env.PYVEX_VERSION }}
          submodules: recursive
          persist-credentials: false

      # make_ffi.py's find_good_scan() feeds cffi partial, deliberately-incomplete
      # subsets of the preprocessed VEX headers and relies on undocumented
      # pycparser error-recovery behaviour to find a clean split. cffi 2.x's
      # pycparser 3.x rewrote that internals (c_lexer's brace/scope tracking),
      # so the scan now dies with "Unmatched '}'" on EVERY arch (reproduced the
      # same failure with a native x86_64 cpp, not just riscv64 -- AVX_512 is an
      # unrelated, correct, arch-independent VEX guest-lifting define, not the
      # bug). pip resolves "cffi>=1.0.3" (pyvex's own floor) to the newest
      # release in the isolated build env, so this started failing the moment
      # cffi 2.0/pycparser 3.0 shipped; cffi 1.17.1 + pycparser 2.22 run
      # find_good_scan() to completion. Pin both below their breaking majors.
      - name: Pin cffi/pycparser below the majors that break make_ffi.py's partial-cdef scan
        run: |
          echo 'cffi<2' >> build-constraints.txt
          echo 'pycparser<3' >> build-constraints.txt

      - name: Build and test wheel
        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
        env:
          CIBW_ARCHS: riscv64
          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
          CIBW_MUSLLINUX_RISCV64_IMAGE: ${{ env.MUSLLINUX_RISCV64_IMAGE }}
          CIBW_BUILD: cp312-${{ matrix.libc }}_riscv64 cp313-${{ matrix.libc }}_riscv64 cp314-${{ matrix.libc }}_riscv64
          CIBW_REPAIR_WHEEL_COMMAND_LINUX: "auditwheel repair --exclude libpyvex.so -w {dest_dir} {wheel}"
          # PIP_BUILD_CONSTRAINT (not PIP_CONSTRAINT) on purpose: it only reaches
          # the isolated build env pip creates for pyvex's own [build-system]
          # requires (where cffi/make_ffi.py actually run), not the later test
          # install. Our registry has no cffi<2 wheel for cp314 (gotcha-574's
          # musllinux leg builds cffi from sdist too, and cp314 in general only
          # got cffi wheels from 2.0.0 on) -- PIP_CONSTRAINT would reach that
          # install too and starve the cp314 test leg of a matching cffi.
          CIBW_ENVIRONMENT: >-
            PIP_BUILD_CONSTRAINT=build-constraints.txt
            PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
          # cffi and bitarray have riscv64 wheels on our registry for manylinux
          # only, so musllinux builds them from sdist; tibs stays binary-only so
          # bitstring resolves to the same 4.3.1 on both legs.
          CIBW_TEST_ENVIRONMENT: ${{ matrix.libc == 'manylinux' && 'PIP_ONLY_BINARY=:all:' || 'PIP_ONLY_BINARY=tibs' }}
          CIBW_TEST_GROUPS: dev
          CIBW_TEST_COMMAND: pytest {project}/tests

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: pyvex-${{ env.PYVEX_VERSION }}-cp312-abi3-${{ matrix.libc }}_riscv64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  publish:
    name: Publish pyvex ${{ matrix.version }}
    needs: [setup, build_wheels]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    permissions:
      contents: write
      pull-requests: write
    uses: $/.github/workflows/_publish-wheel.yml
    secrets:
      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
    with:
      artifact-pattern: pyvex-${{ matrix.version }}-*riscv64